Overview

overview

10

Static

static

10

roblox-player.exe

windows7-x64

10

roblox-player.exe

windows10-2004-x64

Analysis

  • max time kernel
    125s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 17:22

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    roblox-player.exe

  • Size

    78KB

  • MD5

    1e45a9dde0fa43462d3132a6409d6bd3

  • SHA1

    9da3717811e4fbd3f5a8a34f5e6a7ed18e20b22a

  • SHA256

    292f3a442b476c28afc3249f743025dec25bf27d8b17fe77a981eecf0855de13

  • SHA512

    7ad3b6b5cfb79ac02f8c026026ca442f82ee9fec3cf619b32d72ad8ae406a797364b84e4dffaea54f48d3abe3c81b7e109e998330cb734912431e1e666718c4a

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC

Score
10/10
discordratpersistenceratrootkitspywarestealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTE5ODIzNjEyMDA3MzM3MTc1OA.G8u0Ka.A4SAtH9lkH8LkHGGBTIXVQMB7VUu6Xrbs9X1kk

  • server_id

    1237627992709009478

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:604
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1016
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{9b50c5c2-edfe-49f2-bca9-c36d2e679864}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4660
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:672
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:948
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:392
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:916
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1088
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1112
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1164
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:3068
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Drops file in System32 directory
                      PID:1232
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1256
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1296
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1332
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1380
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2600
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1440
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1588
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1596
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1612
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1712
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1744
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1768
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1816
                                                • C:\Windows\system32\AUDIODG.EXE
                                                  C:\Windows\system32\AUDIODG.EXE 0x308 0x4a0
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4904
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:1868
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1876
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1964
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      1⤵
                                                        PID:2040
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:1800
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2136
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                              PID:2220
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2304
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2424
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2432
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                      PID:2592
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2648
                                                                      • C:\Windows\sysmon.exe
                                                                        C:\Windows\sysmon.exe
                                                                        1⤵
                                                                          PID:2680
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                          1⤵
                                                                            PID:2696
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                            1⤵
                                                                              PID:2712
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                              1⤵
                                                                                PID:2720
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:2884
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                  1⤵
                                                                                    PID:2448
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                    1⤵
                                                                                      PID:3352
                                                                                    • C:\Windows\Explorer.EXE
                                                                                      C:\Windows\Explorer.EXE
                                                                                      1⤵
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:3444
                                                                                      • C:\Users\Admin\AppData\Local\Temp\roblox-player.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\roblox-player.exe"
                                                                                        2⤵
                                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1688
                                                                                        • C:\Windows\SYSTEM32\SCHTASKS.exe
                                                                                          "SCHTASKS.exe" /create /tn "$77roblox-player.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\roblox-player.exe'" /sc onlogon /rl HIGHEST
                                                                                          3⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:212
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            4⤵
                                                                                              PID:2296
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                        1⤵
                                                                                          PID:3556
                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                          1⤵
                                                                                            PID:3768
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:3960
                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                              1⤵
                                                                                                PID:4004
                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:4868
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                  1⤵
                                                                                                    PID:4556
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                    1⤵
                                                                                                      PID:2320
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                      1⤵
                                                                                                        PID:3872
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                        1⤵
                                                                                                          PID:1172
                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                          1⤵
                                                                                                            PID:2376
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                            1⤵
                                                                                                              PID:4840
                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                              1⤵
                                                                                                                PID:4668
                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:1896
                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:2016
                                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Modifies registry class
                                                                                                                    PID:3292
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                    1⤵
                                                                                                                      PID:2096
                                                                                                                    • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                      C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                      1⤵
                                                                                                                        PID:2272
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                        1⤵
                                                                                                                          PID:4892
                                                                                                                        • C:\Windows\System32\mousocoreworker.exe
                                                                                                                          C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:4236
                                                                                                                          • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                            1⤵
                                                                                                                              PID:1832

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • memory/392-292-0x00000254C4C90000-0x00000254C4CBA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/392-50-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/392-49-0x00000254C4C90000-0x00000254C4CBA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/604-36-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/604-43-0x00000209DF480000-0x00000209DF4AA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/604-35-0x00000209DF480000-0x00000209DF4AA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/604-28-0x00000209DF450000-0x00000209DF473000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              140KB

                                                                                                                              Download

                                                                                                                            • memory/672-30-0x000001C5DAFB0000-0x000001C5DAFDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/672-31-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/672-41-0x000001C5DAFB0000-0x000001C5DAFDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/672-42-0x00007FFD8CF0D000-0x00007FFD8CF0E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/916-53-0x0000022BAEDB0000-0x0000022BAEDDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/916-293-0x0000022BAEDB0000-0x0000022BAEDDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/916-54-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/948-45-0x00000267AE5D0000-0x00000267AE5FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/948-291-0x00007FFD8CF0C000-0x00007FFD8CF0D000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/948-290-0x00000267AE5D0000-0x00000267AE5FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/948-46-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1016-38-0x0000022830E40000-0x0000022830E6A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1016-44-0x0000022830E40000-0x0000022830E6A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1016-39-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1088-60-0x00000216D1140000-0x00000216D116A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1088-61-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1112-64-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1112-63-0x000001CD831B0000-0x000001CD831DA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1164-67-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1164-66-0x00000281DD490000-0x00000281DD4BA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1232-70-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1232-69-0x00000212F2000000-0x00000212F202A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1256-74-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1256-73-0x0000021D9D340000-0x0000021D9D36A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1296-84-0x0000024BB5380000-0x0000024BB53AA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                              Download

                                                                                                                            • memory/1296-85-0x00007FFD4CEF0000-0x00007FFD4CF00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              Download

                                                                                                                            • memory/1688-11-0x00007FFD6EE60000-0x00007FFD6F921000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/1688-7-0x00000250470E0000-0x000002504718A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              680KB

                                                                                                                              Download

                                                                                                                            • memory/1688-1-0x00007FFD6EE63000-0x00007FFD6EE65000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/1688-2-0x0000025046D20000-0x0000025046EE2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.8MB

                                                                                                                              Download

                                                                                                                            • memory/1688-18-0x00007FFD8CE70000-0x00007FFD8D065000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                              Download

                                                                                                                            • memory/1688-3-0x00007FFD6EE60000-0x00007FFD6F921000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/1688-4-0x0000025047560000-0x0000025047A88000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.2MB

                                                                                                                              Download

                                                                                                                            • memory/1688-5-0x00007FFD6EE63000-0x00007FFD6EE65000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/1688-19-0x00007FFD8CD70000-0x00007FFD8CE2E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              760KB

                                                                                                                              Download

                                                                                                                            • memory/1688-17-0x00000250472C0000-0x00000250472FE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              248KB

                                                                                                                              Download

                                                                                                                            • memory/1688-16-0x00000250470B0000-0x00000250470CE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              120KB

                                                                                                                              Download

                                                                                                                            • memory/1688-15-0x0000025047070000-0x0000025047082000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              Download

                                                                                                                            • memory/1688-14-0x00000250474E0000-0x0000025047556000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              472KB

                                                                                                                              Download

                                                                                                                            • memory/1688-13-0x00007FFD6EE60000-0x00007FFD6F921000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/1688-12-0x000002502E620000-0x000002502E62E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/1688-0-0x000002502C760000-0x000002502C778000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              96KB

                                                                                                                              Download

                                                                                                                            • memory/1688-6-0x00007FFD6EE60000-0x00007FFD6F921000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/4660-23-0x00007FFD8CE70000-0x00007FFD8D065000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                              Download

                                                                                                                            • memory/4660-20-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              256KB

                                                                                                                              Download

                                                                                                                            • memory/4660-22-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              256KB

                                                                                                                              Download

                                                                                                                            • memory/4660-21-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              256KB

                                                                                                                              Download

                                                                                                                            • memory/4660-25-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              256KB

                                                                                                                              Download

                                                                                                                            • memory/4660-24-0x00007FFD8CD70000-0x00007FFD8CE2E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              760KB

                                                                                                                              Download